{
  "cve": "CVE-2026-81535",
  "recipe": "autotools-upstream-regression-differential-v1",
  "repository": "https://github.com/wolfSSL/wolfssh",
  "vulnerableSha": "673b2d25e72ca24fe465d1c644a634e650cdd4f4",
  "fixedSha": "616eb681e70759c30c3ba158f2b18d7bd954def8",
  "testPatchSource": "https://github.com/wolfSSL/wolfssh/commit/616eb681e70759c30c3ba158f2b18d7bd954def8",
  "testTarget": "tests/regress.test",
  "configureFlags": "--enable-fwd",
  "inputHashes": {
    "vulnerableArchive": "0231d4bb67ffffd8047a34c98b4b0f45ff6498e2200a66affed717283c228cdd",
    "fixedArchive": "d1f491a8b6112c7468292f3d86ac53cce4f495918063e0b8f60ee1141ad2561b",
    "testPatch": "4efaff9b0b2fbc21e3da6f630231daa63d296ddf1ab5a48e22b6c8f5ce09240b"
  },
  "runtimeIdentity": "bc9bc6d97c8183541197470fc9b66954c184050afe33f13753fd73e1a702f903",
  "isolation": "QEMU/KVM; no NIC; no host mounts; 1 GiB; 2 vCPU; 360 second timeout",
  "assertion": "the upstream regression added by the fix fails on the exact parent and passes on the fixed commit",
  "results": {
    "patchResult": 0,
    "vBuild": 0,
    "fBuild": 0,
    "vTest": 134,
    "fTest": 0,
    "vmExit": 0
  },
  "verified": true,
  "plan": "Acquire https://github.com/wolfSSL/wolfssh at the exact affected and fixed revisions identified by the advisory. Build only inside an ephemeral, network-isolated VM. Run a minimal synthetic assertion for the behavior described by CVE-2026-81535, then repeat the identical assertion against the fixed revision. Do not claim reproduction unless the vulnerable result is observed and the evidence bundle records versions, commands, output, and teardown.\n\nAutomated isolated preflight inspected the referenced source change, but no grounded runnable vulnerability assertion was available. This remains source analysis only.\n\nThe isolated build/test attempt did not establish the expected vulnerable/fixed differential; inspect the evidence bundle.\n\nThe isolated build/test attempt did not establish the expected vulnerable/fixed differential; inspect the evidence bundle.\n\nThe isolated build/test attempt did not establish the expected vulnerable/fixed differential; inspect the evidence bundle.\n\nThe upstream regression added by the fix failed on the exact vulnerable parent and passed on the fixed commit in a networkless VM.",
  "runAt": "2026-10-17T03:24:56.328Z",
  "runtimePackagesHash": "0f7de4679268a760a801ed94ac27f3a86890f87f431f85ff447f7745545ceaed"
}